

<!DOCTYPE html>
<html lang="zh-CN" data-default-color-scheme=&#34;auto&#34;>



<head>
  <meta charset="UTF-8">
  <link rel="apple-touch-icon" sizes="76x76" href="/img/2.jpg">
  <link rel="icon" type="image/png" href="/img/2.jpg">
  <meta name="viewport"
        content="width=device-width, initial-scale=1.0, maximum-scale=1.0, user-scalable=no, shrink-to-fit=no">
  <meta http-equiv="x-ua-compatible" content="ie=edge">
  
  <meta name="theme-color" content="#2f4154">
  <meta name="description" content="">
  <meta name="author" content="K">
  <meta name="keywords" content="">
  <title>docker核心原理-PID隔离问题解决_通过ssh连接容器 - K</title>

  <link  rel="stylesheet" href="https://cdn.staticfile.org/twitter-bootstrap/4.4.1/css/bootstrap.min.css" />


  <link  rel="stylesheet" href="https://cdn.staticfile.org/github-markdown-css/4.0.0/github-markdown.min.css" />
  <link  rel="stylesheet" href="/lib/hint/hint.min.css" />

  
    
    
      
      <link  rel="stylesheet" href="https://cdn.staticfile.org/highlight.js/10.0.0/styles/github-gist.min.css" />
    
  

  


<!-- 主题依赖的图标库，不要自行修改 -->

<link rel="stylesheet" href="//at.alicdn.com/t/font_1749284_ba1fz6golrf.css">



<link rel="stylesheet" href="//at.alicdn.com/t/font_1736178_kmeydafke9r.css">


<link  rel="stylesheet" href="/css/main.css" />

<!-- 自定义样式保持在最底部 -->


  <script  src="/js/utils.js" ></script>
  <script  src="/js/color-schema.js" ></script>
<meta name="generator" content="Hexo 5.2.0"></head>


<body>
  <header style="height: 70vh;">
    <nav id="navbar" class="navbar fixed-top  navbar-expand-lg navbar-dark scrolling-navbar">
  <div class="container">
    <a class="navbar-brand"
       href="/">&nbsp;<strong>かい</strong>&nbsp;</a>

    <button id="navbar-toggler-btn" class="navbar-toggler" type="button" data-toggle="collapse"
            data-target="#navbarSupportedContent"
            aria-controls="navbarSupportedContent" aria-expanded="false" aria-label="Toggle navigation">
      <div class="animated-icon"><span></span><span></span><span></span></div>
    </button>

    <!-- Collapsible content -->
    <div class="collapse navbar-collapse" id="navbarSupportedContent">
      <ul class="navbar-nav ml-auto text-center">
        
          
          
          
          
            <li class="nav-item">
              <a class="nav-link" href="/">
                <i class="iconfont icon-home-fill"></i>
                首页
              </a>
            </li>
          
        
          
          
          
          
            <li class="nav-item">
              <a class="nav-link" href="/archives/">
                <i class="iconfont icon-archive-fill"></i>
                归档
              </a>
            </li>
          
        
          
          
          
          
            <li class="nav-item">
              <a class="nav-link" href="/categories/">
                <i class="iconfont icon-category-fill"></i>
                分类
              </a>
            </li>
          
        
          
          
          
          
            <li class="nav-item">
              <a class="nav-link" href="/tags/">
                <i class="iconfont icon-tags-fill"></i>
                标签
              </a>
            </li>
          
        
          
          
          
          
            <li class="nav-item">
              <a class="nav-link" href="/about/">
                <i class="iconfont icon-user-fill"></i>
                关于
              </a>
            </li>
          
        
        
          <li class="nav-item" id="search-btn">
            <a class="nav-link" data-toggle="modal" data-target="#modalSearch">&nbsp;<i
                class="iconfont icon-search"></i>&nbsp;</a>
          </li>
        
        
          <li class="nav-item" id="color-toggle-btn">
            <a class="nav-link" href="javascript:">&nbsp;<i
                class="iconfont icon-dark" id="color-toggle-icon"></i>&nbsp;</a>
          </li>
        
      </ul>
    </div>
  </div>
</nav>

    <div class="banner intro-2" id="background" parallax=true
         style="background: url('/img/1.jpg') no-repeat center center;
           background-size: cover;">
      <div class="full-bg-img">
        <div class="mask flex-center" style="background-color: rgba(0, 0, 0, 0.3)">
          <div class="container page-header text-center fade-in-up">
            <span class="h2" id="subtitle">
              
            </span>

            
              <div class="mt-3">
  
  
    <span class="post-meta">
      <i class="iconfont icon-date-fill" aria-hidden="true"></i>
      <time datetime="2020-12-02 13:00" pubdate>
        2020年12月2日 下午
      </time>
    </span>
  
</div>

<div class="mt-1">
  
    
    <span class="post-meta mr-2">
      <i class="iconfont icon-chart"></i>
      920 字
    </span>
  

  
    
    <span class="post-meta mr-2">
      <i class="iconfont icon-clock-fill"></i>
      
      
      14
       分钟
    </span>
  

  
  
</div>

            
          </div>

          
        </div>
      </div>
    </div>
  </header>

  <main>
    
      

<div class="container-fluid">
  <div class="row">
    <div class="d-none d-lg-block col-lg-2"></div>
    <div class="col-lg-8 nopadding-md">
      <div class="container nopadding-md" id="board-ctn">
        <div class="py-5" id="board">
          <article class="post-content mx-auto" id="post">
            <!-- SEO header -->
            <h1 style="display: none">docker核心原理-PID隔离问题解决_通过ssh连接容器</h1>
            
            <div class="markdown-body" id="post-body">
              <h2 id="docker——通过ssh连接容器"><a href="#docker——通过ssh连接容器" class="headerlink" title="docker——通过ssh连接容器"></a>docker——通过ssh连接容器</h2><pre><code class="hljs autoit"><span class="hljs-meta"># 容器安装sshd服务，便于主机ssh连接容器</span>
[root<span class="hljs-symbol">@localhost</span> ~]<span class="hljs-meta"># docker run -itd --name sshd centos /bin/bash</span>
<span class="hljs-number">374</span>daee545e3a9fb1b6faa4075fc3ce295418cd2c83532627d88a28f6657a672
<span class="hljs-meta"># 进入容器</span>
[root<span class="hljs-symbol">@localhost</span> ~]<span class="hljs-meta"># docker exec -it sshd /bin/bash</span>
<span class="hljs-meta"># 安装一些软件（ssh相关）</span>
[root<span class="hljs-symbol">@374daee545e3</span> /]<span class="hljs-meta"># yum -y install passwd iproute net-tools openssh-server openssh-clients</span></code></pre>
<blockquote>
<p>设置容器root密码(一会ssh连接容器要用)</p>
</blockquote>
<pre><code class="hljs smali">[root@374daee545e3 /]<span class="hljs-comment"># passwd root</span>
Changing password for user root.
New password: 
BAD PASSWORD: The password fails the dictionary<span class="hljs-built_in"> check </span>- it is too simplistic/systematic
Retype<span class="hljs-built_in"> new </span>password: 
passwd: all authentication tokens updated successfully.</code></pre>
<blockquote>
<p>查看sshd程序的启动命令</p>
</blockquote>
<pre><code class="hljs routeros">vi /usr/lib/systemd/system/sshd.service

[Unit]
<span class="hljs-attribute">Description</span>=OpenSSH<span class="hljs-built_in"> server </span>daemon
<span class="hljs-attribute">Documentation</span>=man:sshd(8) man:sshd_config(5)
<span class="hljs-attribute">After</span>=network.target sshd-keygen.service
<span class="hljs-attribute">Wants</span>=sshd-keygen.service

[Service]
<span class="hljs-attribute">Type</span>=notify
<span class="hljs-attribute">EnvironmentFile</span>=/etc/sysconfig/sshd
<span class="hljs-attribute">ExecStart</span>=/usr/sbin/sshd -D <span class="hljs-variable">$OPTIONS</span> # 这里就是sshd程序的启动命令了 有些程序需要传递一些参数，要看的话就看上面的文件是否有参数，如果有就加上
<span class="hljs-attribute">ExecReload</span>=/bin/kill -HUP <span class="hljs-variable">$MAINPID</span>
<span class="hljs-attribute">KillMode</span>=process
<span class="hljs-attribute">Restart</span>=on-failure
<span class="hljs-attribute">RestartSec</span>=42s

[Install]
<span class="hljs-attribute">WantedBy</span>=multi-user.target
</code></pre>
<blockquote>
<p>设置秘钥（容器缺少一些必要的秘钥）</p>
</blockquote>
<pre><code class="hljs awk"><span class="hljs-comment"># 生成三个秘钥</span>
[root@<span class="hljs-number">374</span>daee545e3 <span class="hljs-regexp">/]# ssh-keygen -q -t rsa -b 2048 -f /</span>etc<span class="hljs-regexp">/ssh/</span>ssh_host_rsa_key -N <span class="hljs-string">&#x27;&#x27;</span>
[root@<span class="hljs-number">374</span>daee545e3 <span class="hljs-regexp">/]# ssh-keygen -q -t ecdsa -f /</span>etc<span class="hljs-regexp">/ssh/</span>ssh_host_ecdsa_key -N <span class="hljs-string">&#x27;&#x27;</span>
[root@<span class="hljs-number">374</span>daee545e3 <span class="hljs-regexp">/]# ssh-keygen -q -t dsa -f /</span>etc<span class="hljs-regexp">/ssh/</span>ssh_host_ed25519_key -N <span class="hljs-string">&#x27;&#x27;</span>

-t：keygen类型   -b密钥的长度   -f生成文件的位置   -N’’文件替换  ‘’原来是没有的	-q 不显示</code></pre>
<blockquote>
<p>允许root账户ssh连接</p>
</blockquote>
<pre><code class="hljs yaml"><span class="hljs-string">vi</span> <span class="hljs-string">/etc/ssh/sshd_config</span> 

<span class="hljs-string">UsePAM</span> <span class="hljs-literal">no</span>
<span class="hljs-string">UsePrivilegeSeparation</span> <span class="hljs-literal">no</span>
<span class="hljs-comment"># PAM  加密模块，热插拔加密，容器里没有PAM，不能使用pam验证</span>
<span class="hljs-string">PermitRootLogin</span> <span class="hljs-literal">yes</span>
<span class="hljs-comment"># 允许超级用户登录</span>
</code></pre>
<blockquote>
<p>启动sshd，主机连接容器</p>
</blockquote>
<pre><code class="hljs vbnet">[root@<span class="hljs-number">374</span>daee545e3 /]<span class="hljs-meta"># /usr/sbin/sshd -D $OPTIONS</span>
WARNING: <span class="hljs-comment">&#x27;UsePAM no&#x27; is not supported in Red Hat Enterprise Linux and may cause several problems.</span>
Segmentation fault (core dumped)


[root@<span class="hljs-number">374</span>daee545e3 /]<span class="hljs-meta"># exit</span>
<span class="hljs-keyword">exit</span>
[root@localhost ~]<span class="hljs-meta"># ssh root@172.17.0.2</span>
The authenticity <span class="hljs-keyword">of</span> host <span class="hljs-comment">&#x27;172.17.0.2 (172.17.0.2)&#x27; can&#x27;t be established.</span>
ECDSA <span class="hljs-keyword">key</span> fingerprint <span class="hljs-keyword">is</span> SHA256:RIjDV9o2h4opVpD2MFlCCFq39l/q4aJNLwXvTqfZo/s.
ECDSA <span class="hljs-keyword">key</span> fingerprint <span class="hljs-keyword">is</span> MD5:<span class="hljs-number">0</span>e:f6:dc:fb:<span class="hljs-number">0</span>e:<span class="hljs-number">87</span>:d8:<span class="hljs-number">25</span>:<span class="hljs-number">61</span>:eb:<span class="hljs-number">47</span>:eb:<span class="hljs-number">4</span>a:<span class="hljs-number">90</span>:<span class="hljs-number">24</span>:<span class="hljs-number">92.</span>
Are you sure you want <span class="hljs-keyword">to</span> <span class="hljs-keyword">continue</span> connecting (yes/no)? yes
Warning: Permanently added <span class="hljs-comment">&#x27;172.17.0.2&#x27; (ECDSA) to the list of known hosts.</span>
root@<span class="hljs-number">172.17</span><span class="hljs-number">.0</span><span class="hljs-number">.2</span><span class="hljs-comment">&#x27;s password: </span>
[root@<span class="hljs-number">374</span>daee545e3 ~]<span class="hljs-meta"># </span>
<span class="hljs-meta"># 连接到容器了</span></code></pre>

<h2 id="docker-PID隔离问题"><a href="#docker-PID隔离问题" class="headerlink" title="docker_PID隔离问题"></a>docker_PID隔离问题</h2><ul>
<li>1.通过容器内用户提权来解决不能使用system程序（不建议使用）</li>
<li>2.通过绕开systemd进程来启动程序</li>
<li>注重讲解第2种方法</li>
</ul>
<blockquote>
<p>接上面环境<br>容器安装httpd</p>
</blockquote>
<pre><code class="hljs routeros">[root@374daee545e3 ~]# yum -y install httpd
<span class="hljs-comment"># 查看httpd的启动地址</span>
vi /usr/lib/systemd/system/httpd.service

[Unit]
<span class="hljs-attribute">Description</span>=The Apache HTTP Server
<span class="hljs-attribute">After</span>=network.target remote-fs.target nss-lookup.target
<span class="hljs-attribute">Documentation</span>=man:httpd(8)
<span class="hljs-attribute">Documentation</span>=man:apachectl(8)

[Service]
<span class="hljs-attribute">Type</span>=notify
<span class="hljs-attribute">EnvironmentFile</span>=/etc/sysconfig/httpd # 可以查看启动参数
<span class="hljs-attribute">ExecStart</span>=/usr/sbin/httpd <span class="hljs-variable">$OPTIONS</span> -DFOREGROUND # 这里
<span class="hljs-attribute">ExecReload</span>=/usr/sbin/httpd <span class="hljs-variable">$OPTIONS</span> -k graceful # 都可以
<span class="hljs-attribute">ExecStop</span>=/bin/kill -WINCH <span class="hljs-variable">$&#123;MAINPID&#125;</span>
<span class="hljs-comment"># We want systemd to give httpd some time to finish gracefully, but still want</span>
<span class="hljs-comment"># it to kill httpd after TimeoutStopSec if something went wrong during the</span>
<span class="hljs-comment"># graceful stop. Normally, Systemd sends SIGTERM signal right after the</span>
<span class="hljs-comment"># ExecStop, which would kill httpd. We are sending useless SIGCONT here to give</span>
<span class="hljs-comment"># httpd time to finish.</span>
<span class="hljs-attribute">KillSignal</span>=SIGCONT
<span class="hljs-attribute">PrivateTmp</span>=<span class="hljs-literal">true</span>

[Install]
<span class="hljs-attribute">WantedBy</span>=multi-user.target

<span class="hljs-comment"># 启动出现错误</span>
[root@374daee545e3 ~]# /usr/sbin/httpd <span class="hljs-variable">$OPTIONS</span>
AH00558: httpd: Could <span class="hljs-keyword">not</span> reliably determine the server<span class="hljs-string">&#x27;s fully qualified domain name, using 172.17.0.2. Set the &#x27;</span>ServerName<span class="hljs-string">&#x27; directive globally to suppress this message</span>
<span class="hljs-string"># 修改配置文件</span>
<span class="hljs-string">vi /etc/httpd/conf/httpd.conf </span>
<span class="hljs-string"></span>
<span class="hljs-string">ServerName www.example.com:80 # 取消注释</span>
<span class="hljs-string"># 再次启动看看</span>
<span class="hljs-string">[root@374daee545e3 ~]# /usr/sbin/httpd $OPTIONS</span>
<span class="hljs-string">httpd (pid 169) already running</span>
<span class="hljs-string">[root@374daee545e3 ~]# netstat -anput |grep 80</span>
<span class="hljs-string">tcp        0      0 0.0.0.0:80              0.0.0.0:*               LISTEN      169/httpd    </span>
<span class="hljs-string"></span>
<span class="hljs-string"># 修改httpd的首页</span>
<span class="hljs-string">[root@374daee545e3 ~]# echo &#x27;</span>LMK<span class="hljs-string">&#x27; &gt; /var/www/html/index.html</span>
<span class="hljs-string"># 退出容器访问容器</span>
<span class="hljs-string">[root@374daee545e3 ~]# exit</span>
<span class="hljs-string">logout</span>
<span class="hljs-string">Connection to 172.17.0.2 closed.</span>
<span class="hljs-string">[root@localhost ~]# curl 172.17.0.2</span>
<span class="hljs-string">LMK</span></code></pre>
<h2 id="小结"><a href="#小结" class="headerlink" title="小结"></a>小结</h2><ul>
<li>其实找到程序的启动命令就可以了，ssh为了练习一遍才做的，主要是记住<br>软件的启动文件在哪里就可以</li>
</ul>

            </div>
            <hr>
            <div>
              <div class="post-metas mb-3">
                
                  <div class="post-meta mr-3">
                    <i class="iconfont icon-category"></i>
                    
                      <a class="hover-with-bg" href="/categories/docker/">docker</a>
                    
                  </div>
                
                
                  <div class="post-meta">
                    <i class="iconfont icon-tags"></i>
                    
                      <a class="hover-with-bg" href="/tags/docker/">docker</a>
                    
                  </div>
                
              </div>
              
                <p class="note note-warning">本博客所有文章是以学习为目的，如果有不对的地方可以一起交流沟通共同学习 邮箱:1248287831@qq.com！</p>
              
              
                <div class="post-prevnext row">
                  <article class="post-prev col-6">
                    
                    
                      <a href="/2020/12/02/docker_cgroup/">
                        <i class="iconfont icon-arrowleft"></i>
                        <span class="hidden-mobile">docker核心原理-Cgroup-硬件切割</span>
                        <span class="visible-mobile">上一篇</span>
                      </a>
                    
                  </article>
                  <article class="post-next col-6">
                    
                    
                      <a href="/2020/12/01/docker%E6%A0%B8%E5%BF%83%E5%8E%9F%E7%90%86/">
                        <span class="hidden-mobile">docker核心原理</span>
                        <span class="visible-mobile">下一篇</span>
                        <i class="iconfont icon-arrowright"></i>
                      </a>
                    
                  </article>
                </div>
              
            </div>

            
          </article>
        </div>
      </div>
    </div>
    
      <div class="d-none d-lg-block col-lg-2 toc-container" id="toc-ctn">
        <div id="toc">
  <p class="toc-header"><i class="iconfont icon-list"></i>&nbsp;目录</p>
  <div id="tocbot"></div>
</div>

      </div>
    
  </div>
</div>

<!-- Custom -->


    
  </main>

  
    <a id="scroll-top-button" href="#" role="button">
      <i class="iconfont icon-arrowup" aria-hidden="true"></i>
    </a>
  

  
    <div class="modal fade" id="modalSearch" tabindex="-1" role="dialog" aria-labelledby="ModalLabel"
     aria-hidden="true">
  <div class="modal-dialog modal-dialog-scrollable modal-lg" role="document">
    <div class="modal-content">
      <div class="modal-header text-center">
        <h4 class="modal-title w-100 font-weight-bold">搜索</h4>
        <button type="button" id="local-search-close" class="close" data-dismiss="modal" aria-label="Close">
          <span aria-hidden="true">&times;</span>
        </button>
      </div>
      <div class="modal-body mx-3">
        <div class="md-form mb-5">
          <input type="text" id="local-search-input" class="form-control validate">
          <label data-error="x" data-success="v"
                 for="local-search-input">关键词</label>
        </div>
        <div class="list-group" id="local-search-result"></div>
      </div>
    </div>
  </div>
</div>
  

  

  <footer class="text-center mt-5 py-3">
  <div class="footer-content">
     <a href="https://space.bilibili.com/39165374" target="_blank" rel="nofollow noopener"><span>LMK</span></a> <i class="iconfont icon-love"></i> <a href="https://github.com/fluid-dev/hexo-theme-fluid" target="_blank" rel="nofollow noopener"><span>Fluid</span></a> 
  </div>
  
  <div class="statistics">
    
    

    
      
        <!-- 不蒜子统计PV -->
        <span id="busuanzi_container_site_pv" style="display: none">
            总访问量 
            <span id="busuanzi_value_site_pv"></span>
             次
          </span>
      
      
        <!-- 不蒜子统计UV -->
        <span id="busuanzi_container_site_uv" style="display: none">
            总访客数 
            <span id="busuanzi_value_site_uv"></span>
             人
          </span>
      
    
  </div>


  

  
</footer>

<!-- SCRIPTS -->
<script  src="https://cdn.staticfile.org/jquery/3.4.1/jquery.min.js" ></script>
<script  src="https://cdn.staticfile.org/twitter-bootstrap/4.4.1/js/bootstrap.min.js" ></script>
<script  src="/js/debouncer.js" ></script>
<script  src="/js/main.js" ></script>

<!-- Plugins -->


  
    <script  src="/js/lazyload.js" ></script>
  



  



  <script defer src="https://cdn.staticfile.org/clipboard.js/2.0.6/clipboard.min.js" ></script>
  <script  src="/js/clipboard-use.js" ></script>



  <script defer src="https://busuanzi.ibruce.info/busuanzi/2.3/busuanzi.pure.mini.js" ></script>





  <script  src="https://cdn.staticfile.org/tocbot/4.11.1/tocbot.min.js" ></script>
  <script>
    $(document).ready(function () {
      var boardCtn = $('#board-ctn');
      var boardTop = boardCtn.offset().top;

      tocbot.init({
        tocSelector: '#tocbot',
        contentSelector: '#post-body',
        headingSelector: 'h1,h2,h3,h4,h5,h6',
        linkClass: 'tocbot-link',
        activeLinkClass: 'tocbot-active-link',
        listClass: 'tocbot-list',
        isCollapsedClass: 'tocbot-is-collapsed',
        collapsibleClass: 'tocbot-is-collapsible',
        collapseDepth: 0,
        scrollSmooth: true,
        headingsOffset: -boardTop
      });
      if ($('.toc-list-item').length > 0) {
        $('#toc').css('visibility', 'visible');
      }
    });
  </script>



  <script  src="https://cdn.staticfile.org/typed.js/2.0.11/typed.min.js" ></script>
  <script>
    var typed = new Typed('#subtitle', {
      strings: [
        '  ',
        "docker核心原理-PID隔离问题解决_通过ssh连接容器&nbsp;",
      ],
      cursorChar: "_",
      typeSpeed: 70,
      loop: false,
    });
    typed.stop();
    $(document).ready(function () {
      $(".typed-cursor").addClass("h2");
      typed.start();
    });
  </script>



  <script  src="https://cdn.staticfile.org/anchor-js/4.2.2/anchor.min.js" ></script>
  <script>
    anchors.options = {
      placement: "right",
      visible: "hover",
      
    };
    var el = "h1,h2,h3,h4,h5,h6".split(",");
    var res = [];
    for (item of el) {
      res.push(".markdown-body > " + item)
    }
    anchors.add(res.join(", "))
  </script>



  <script  src="/js/local-search.js" ></script>
  <script>
    var path = "/local-search.xml";
    var inputArea = document.querySelector("#local-search-input");
    inputArea.onclick = function () {
      searchFunc(path, 'local-search-input', 'local-search-result');
      this.onclick = null
    }
  </script>



  <script  src="https://cdn.staticfile.org/fancybox/3.5.7/jquery.fancybox.min.js" ></script>
  <link  rel="stylesheet" href="https://cdn.staticfile.org/fancybox/3.5.7/jquery.fancybox.min.css" />

  <script>
    $('#post img:not(.no-zoom img, img[no-zoom]), img[zoom]').each(
      function () {
        var element = document.createElement('a');
        $(element).attr('data-fancybox', 'images');
        $(element).attr('href', $(this).attr('src'));
        $(this).wrap(element);
      }
    );
  </script>















</body>
</html>
